# Ransomware Actors Escalate to Personal Intimidation and Physical Threats Against Victim Staff (Semperis 2026 Ransomware Risk Report)

> Semperis' 2026 ransomware report (published 2026-10-14) finds that a large share of ransomware attacks now include psychological or physical threats against victim staff and their families, including doxxing, swatting and threats of physical intrusion. The Register names Midnight Blizzard, Scattered Spider, ShinyHunters and Lapsus$ in this context; the latter three are publicly linked to the youth cybercrime network 'The Com'.

- **Published:** 2026-10-14T05:30:53Z
- **Last reviewed:** 2026-10-14T05:30:53Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-3467
- **ID:** TL-2026-3467
- **Severity:** MEDIUM
- **Category:** RANSOMWARE
- **Status:** ACTIVE
- **Actor:** Scattered Spider
- **Detections:** 9 · **IOCs:** 23 (full data via the Threadlinqs MCP server — Purple tier)

## Description

Semperis published its 2026 Ransomware Report on 2026-10-14, covering ransomware victims in the U.S., UK, France, Germany, Italy, Spain, Singapore, Canada and Australia. The company's press release reports that 40% of attacks involved psychological or physical threats against staff, 87% of attacks weaponized AI, 87% targeted identity systems (Active Directory, Entra ID, Okta), 70% of victims were targeted multiple times and 31% paid more than once. Of victims who were threatened, 53% said the attackers followed through; 23% of victims or their families were swatted, 25% sought psychological or medical treatment, and 24% hired personal security.

The Register's coverage of the same report (Jessica Lyons, 2026-10-14) gives a slightly different headline figure, 37% of attacks with psychological or physical threats, and states that 1,200 post-ransomware organizations were surveyed. The Semperis press release excerpt does not state the sample size, and a search returned the '1,200 organizations' figure only as Semperis' customer count. Both the 37% vs 40% discrepancy and the sample size should be verified against the primary report. The Register lists threat forms reported by victims: threatening texts, letters or packages (57%), threats against family or friends (37%), physical intrusion (19%), abduction threats (17%), bodily harm threats (13%) and stalking (6%). It also cites doxxing (25%) and swatting (23%). Anecdotes include a package of Russian nesting dolls and regional gifts sent to Tim Beasley, and C-suite executives receiving pictures of their children's schools.

The Register names Midnight Blizzard (linked to Russia's SVR), Scattered Spider, ShinyHunters and Lapsus$. Per Europol-related reporting, Scattered Spider, Lapsus$ and ShinyHunters are believed to be associated with The Com, a youth cybercrime network based in the United States and United Kingdom. Europol's EU Internet Referral Unit and Spain's CITCO flagged 4,340 URLs tied to The Com during Referral Action Days in June-July 2026. The article does not state that Midnight Blizzard uses physical intimidation; no actor-specific attribution of the surveyed intimidation is made in the sources.

Technical tradecraft of the Com-linked actors is documented by CISA (AA23-320A, updated 2025-07-29): help-desk vishing and phishing/smishing, purchased credentials, abuse of trusted IT contractor relationships, MFA token registration, RMM tool deployment, federated IdP additions to SSO, new account creation, exfiltration to MEGA.NZ and Amazon S3, extortion without encryption, and DragonForce ransomware on ESXi. Resecurity (2025-09-25) adds SIM swapping, MFA push fatigue, infostealers (Lumma, Azorult, RedLine, Raccoon, Vidar), Salesforce OAuth token theft and the shinysp1d3r ransomware-as-a-service Telegram channel. This record is a trend/survey entry with no CVEs; the intimidation findings are secondary-source reporting. Defensive priority is identity-system resilience (dedicated identity backups, automated AD recovery), help-desk verification hardening, and executive/family protection and incident-response planning that anticipates personal coercion.

## MITRE ATT&CK

- T1598.004 Spearphishing Voice
- T1566.004 Spearphishing Voice
- T1199 Trusted Relationship
- T1078 Valid Accounts
- T1621 Multi-Factor Authentication Request Generation
- T1556.006 Multi-Factor Authentication
- T1528 Steal Application Access Token
- T1136 Create Account
- T1484.002 Trust Modification
- T1219 Remote Access Tools
- T1213 Data from Information Repositories
- T1567.002 Exfiltration to Cloud Storage
- T1657 Financial Theft

## Sources

- [Ransomware gets personal: 'We-know-where-you-are kind of stuff' (The Register)](https://www.theregister.com/cyber-crime/2026/10/14/ransomware-gets-personal-we-know-where-you-are-kind-of-stuff/5302939)
- [Semperis 2026 Ransomware Report Reveals Increases in AI-Driven Attacks and a Rise in Physical Threats Against Executives and Their Families](https://www.prnewswire.com/news-releases/semperis-2026-ransomware-report-reveals-increases-in-ai-driven-attacks-and-a-rise-in-physical-threats-against-executives-and-their-families-302907731.html)
- [CISA Advisory AA23-320A: Scattered Spider](https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-320a)
- [Trinity of Chaos: The LAPSUS$, ShinyHunters and Scattered Spider Alliance Embarks on Global Cybercrime Spree (Resecurity)](https://www.resecurity.com/blog/article/trinity-of-chaos-the-lapsus-shinyhunters-and-scattered-spider-alliance-embarks-on-global-cybercrime-spree)
- [Europol flags 4,340 URLs for removal in 'The Com' crackdown (BleepingComputer)](https://www.bleepingcomputer.com/news/security/europol-flags-4-340-urls-for-removal-in-the-com-crackdown/)
- [Europol flags 4,340 URLs tied to Com network (GovInfoSecurity)](https://www.govinfosecurity.com/europol-flags-4340-urls-tied-to-com-network-a-32325)
- [Ransomware tactics now include physical coercion as gangs escalate pressure (TeissNews)](https://www.teiss.co.uk/news/ransomware-tactics-now-include-physical-coercion-as-gangs-escalate-pressure-16181)
- [Semperis reports escalating ransomware tactics, as physical threats and regulatory extortion rise (Industrial Cyber, prior-year report)](https://industrialcyber.co/news/semperis-reports-escalating-ransomware-tactics-as-physical-threats-and-regulatory-extortion-rise/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-3467